KasperskyRed TeamingKaspersky Red Teaming

2Overview
Completely preventing information assets from being compromised
can be extremely difficult in large networks, or even impossible whenattacks are launched using zero-day vulnerabilities.
That's why it's critical to do everything you can to ensure that
information security incidents are detected as early as possible.
Mature organizations with well-established processes for security
assessments, vulnerability management, and information security
incident detection should conduct Red Teaming tests.
These tests determine how well infrastructures are protected againsthighly skilled attackers operating with maximum stealth, and help train
the IT security team to identify and respond to attacks under real-worldconditions.

Kaspersky Red Teaming

3

How Kaspersky Red Teaming works?
Threat Intelligence

The service begins with a discussion of the customer's known threats and Blue Team
experience. The goal is to identify the most critical business assets and understandhow the project deliverables can be tailored to the TTPs used by the company'sdefense. However, during these discussions Kaspersky will not request any
information about the target assets, as the Red Team will also conduct independent
information gathering activities, just as real adversaries would. The information
gathering phase includes both the analysis of publicly available information (opensource intelligence) and the analysis of data available in underground communities.

Adversary Simulation

This phase begins with the preparation of attack scenarios and tools based on theresults of the threat intelligence phase.
Preparation may include in-depth research of systems used in the client'senvironment to identify new vulnerabilities, development of custom tools to bypass
the client's security systems, or preparation of spear-phishing attacks. Oncethe preparation is complete, Kaspersky performs the active phase of adversarysimulation.
The tests are performed based on customer-specific scenarios using special
techniques to avoid detection by the Blue Team. After the Red Team completes its
objectives, activities that trigger incident detection and response are carried out toinvolve the Blue Team in the exercise.

Adversary simulation tests may include:• Adversary simulation tests may include:• Passive information gathering• Active information gathering (network discovery)• including port scanning, identification of available services, and manual requests
to specific services (DNS, mail)• Web application security (using both automated and manual approaches) to
identify the various types of vulnerabilities• Web application security (using both automated and manual approaches) to
identify the various types of vulnerabilities• Manual vulnerability analysis, including identification of resources withoutauthentication, important publicly available information, insufficient access
control• Credential guessing• Social engineering tests• Exploiting one or more of the vulnerabilities found and escalating privileges (ifpossible)• Developing an attack using the privileges gained and the techniques listed
above until the service provider is able to can access the LAN or critical network
resources (e.g., Active Directory domain controllers, business systems, DBMSs,etc.) or until all attack methods available during the available during the test havebeen exhausted.

Report Preparation

During this stage, Kaspersky will analyze the results of the Adversary Simulation,
prepare a report with a detailed description of the attacks (including timestamps
and indicators of compromise), and provide recommendations.

Overview of Testing
Results

A post-assessment workshop can be arranged with the company's Blue Team todiscuss project results, reasons for any undetected or unprevented issues, andpotential defense improvements.

Kaspersky Red Teaming

4

Kaspersky Red Teaming methodology
The following security
assessment tools canbe used:• Information gathering tools(Maltego, theHarvester andothers)• Various general-purpose
and specialized scanners(NMap, MaxPatrol, Nessus,AcuneticsWVS, nbtscan andothers)• Complex security assessment
solutions (KaliLinux)• Credentials guessing tools(Hydra, ncrack, Bruter,andothers)• Specialized solutions forweb application security
assessment (OWASPdirbuster,BurpSuite, ProxyStrike, various
plug-ins for Mozilla Firefox)• Network traffic analyzers(Wireshark, Cain and Abel)• Credentials extraction andmanagement tools (Mimikatz,WCE, pwdump and others)• Specialized tools for various
types of attacks (Yersinia,Loki,Responder, SIPVicious andothers)• Disassembling and debugging
tools (IDA Pro, OllyDbg)• And others, including limitedaccess exploits and custom
exploitation tools developed bythe Service Provider.

Red Teaming is similar to a real hacker attack and allows for theevaluation of protection measures in practice. However, unlike a hacker
attack, this service is performed by experienced security experts from
Kaspersky who prioritize system confidentiality, integrity, and availability
while strictly adhering to international standards and best practices,such as:12

Penetration Testing Execution
Standard (PTES)NIST Special Publications
800-115 Technical Guide toInformation Security Testingand Assessment

34Open Source Security Testing
Methodology Manual (OSSTMM)

Information Systems Security
Assessment Framework(ISSAF)

5

6

Web Application Security
Consortium (WASC)

Threat Classification Open Web
Application Security Project(OWASP)

7Testing Guide Common
Vulnerability Scoring System(CVSS)

8
And other applicable standards
based on your organization's
business and location

To ensure the legality and safety of Red Teaming, the customer must
provide an official employee as a point of contact for all projectcommunications, including scope negotiations, resolving access issues,and confirming active works. The representative must have an email
address belonging to the customer's domain name and not be a thirdparty intermediary.

Kaspersky Red Teaming

5

Kaspersky Red Teaming outcome
Executive summary

After the service, customers will receive a report that includes
high-level conclusions on the identified defensive capabilities andrecommendations to improve them.

Vulnerability details

In addition, the report includes a detailed description of thevulnerabilities found, including severity level, complexity ofexploitation, potential impact on the vulnerable system, andevidence of the existence of the vulnerabilities (where possible).

Activity details

A detailed description of activities, including timestamps andindicators of compromise, is provided for the analysis andimprovement of the defensive team.

Recommendations

For eliminating vulnerabilities, improving incident response
processes, and mitigating identified prevention and detection issues
are also included.

Why Kaspersky?
Prioritizing
Security

ProtectingYour Data

Our top priority is ensuring theconfidentiality, integrity, andavailability of your resources.
Kaspersky's experts will takeall necessary precautions
to prevent any harm to yourenvironment.

We will store and transfer all
sensitive technical information
related to the project, including
important data, credentials,and assessment results,using strong encryption. Ifrequested, this information
can be deleted after theproject is completed.

www.kaspersky.com© 2024 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

ProvidingExpertise
Our team of security assessment
experts are highly experienced
professionals with deep knowledgeof the field. They constantly
develop and hone their skills.
They have been recognized fortheir security research by industry
leaders such as Oracle, Google,Apple, Microsoft, Facebook,PayPal, Siemens, SAP, and others#kaspersky#bringonthefuture